Case Studies xv
Preface xvii
Acknowledgments xxi
CHAPTER 1 CAATTs History 1
The New Audit Environment 2
The Age of Information Technology 3
Decentralization of Technology 3
Absence of the Paper Trail 4
Do More with Less 4
Definition of CAATTs 5
Evolution of CAATTs 6
Audit Software Developments 7
Historical CAATTs 8
Test Decks 8
Integrated Test Facility (ITF) 9
System Control Audit Review File (SCARF) 9
Sample Audit Review File (SARF) 9
Sampling 10
Parallel Simulation 10
Reasonableness Tests and Exception Reporting 11
Traditional Approaches to Computer-Based Auditing 12
Systems-Based Approach 12
Data-Based Approach 15
Audit Management and Administrative Support 19
Roadblocks to CAATT Implementation 20
Summary and Conclusions 24
CHAPTER 2 Audit Technology 27
Audit Technology Continuum 27
Introductory Use of Technology 27
Moderate Use of Technology 28
Integral Use of Technology 29
Advanced Use of Technology 30
Getting There 31
General Software Useful for Auditors 32
Word Processing 32
Text Search and Retrieval 34
Reference Libraries 35
Spreadsheets 35
Presentation Software 37
Flowcharting 38
Antivirus and Firewall Software 39
Software Licensing Checkers 39
Specialized Audit Software Applications 40
Data Access, Analysis, Testing, and Reporting 40
Standardized Extractions and Reports 44
Information Downloaded from Mainframe Applications and/or Client Systems 45
Electronic Questionnaires and Audit Programs 48
Control Self-Assessment 49
Parallel Simulation 50
Electronic Working Papers 51
Data Warehouse 52
Data Mining 54
Software for Audit Management and Administration 56
Audit Universe 56
Audit Department Management Software 57
E-mail 57
File Transfer Protocol (FTP) 57
Intranet 59
Databases 60
Groupware 61
Electronic Document Management 61
Electronic Audit Reports and Methodologies 62
Audit Scheduling, Time Reporting, and Billing 63
Project Management 64
Extensible Business Reporting Language (XBRL) 64
Expert Systems 67
Audit Early-Warning Systems 68
Continuous Auditing 69
Continuous Auditing versus ContinuousMonitoring 72
Example of Continuous Auditing: Application to an Accounts Payable Department 74
Stages of Continuous Auditing 77
Continuous Auditing Template 79
Sarbanes-Oxley 80
Important SOX Sections 81
The Role and Responsibility of Internal Audit 83
Risk Factors 84
Detecting Fraud 85
Determining the Exposure to Fraud 86
SOX Software 88
Assessment of IT Controls and Risks 90
Defining the Scope 92
GAIT Principles 93
Governance, Risk Management, and Compliance (GRC) 94
Internal Audit's Role in the GRC Process 97
Identifying and Assessing Management's Risk Management Process 99
Assessment of Internal Control Processes 100
GRC Software 101
Summary and Conclusions 102
CHAPTER 3 CAATTs Benefits and Opportunities 103
The Inevitability of Using CAATTs 103
The New IM Environment 105
The New Audit Paradigm 105
Expected Benefits 108
Planning Phase-Benefits 109
Conduct Phase-Benefits 112
Data Analysis 112
Increased Coverage 112
Better Use of Auditor Resources 115
Improved Results 116
Reporting Phase-Benefits 116
Administration of the Audit Function-Benefits 117
Reduced Costs 119
Increased Performance 120
Increased Time for Critical Thinking 122
Recognizing Opportunities 124
Transfer of Audit Technology 126
Summary and Conclusions 127
CHAPTER 4 CAATTs for Broader-Scoped Audits 129
Integrated Use of CAATTs 129
Value-for-Money Auditing 134
Value-Added Auditing of Inventory Systems 134
Data Analysis in Support of Value-Added Inventory Auditing 135
Inventory Management Practices and Approaches 136
Possible Areas for Audit-Suggested Improvements 138
Audit and Reengineering 144
Audit and Benchmarking 148
Summary and Conclusions 152
CHAPTER 5 Data Access and Testing 153
Data Access Conditions 153
Mainframe versus Minicomputer versus Microcomputer 154
Portability of Programs and Data 154
Limitations to Using the Microcomputer 155
Processing Speeds 155
Single Tasking 156
Inability to Deal with Complex Data and File Structures 156
Client Facilities 157
Auditor's Microcomputer-Based Facilities 158
Data Extraction and Analysis Issues 159
Accessing the Data 160
Data Storage Requirements 161
Analysis of Data 162
Risks of Relying on Data-Reliability Risk 163
Reliance on the Data 164
Knowledge of the System 165
Assessment of the Internal Controls 166
New Topology of Data Tests 167
Reducing Auditor-Induced Data Corruption 168
Potential Problems with the Use of CAATTs 169
Incorrect Identification of Audit Population 169
Improper Description of Data Requirements 171
Invalid Analyses 172
Failure to Recognize CAATT Opportunities 173
Summary and Conclusions 174
CHAPTER 6 Developing CAATT Capabilities 177
Professional Proficiency: Knowledge, Skills, and Disciplines 177
Computer Literacy: Minimal Auditor Skills 178
Ability to Use CAATTs 180
Understanding of the Data 181
Analytical Support and Advice 182
Communication of Results 184
Steps in Developing CAATT Capabilities 184
Understand the Organizational Environment/Assess the Organizational Culture 184
Obtain Management Commitment 185
Establish Deliverables 186
Set Up a Trial 186
Plan for Success 186
Track Costs and Benefits 187
Lessons Learned 187
Organize Working Groups 188
Computer Literacy Working Group 189
CAATT Working Groups 190
Information Systems Support to Audit 191
Assure Quality 195
Quality Assurance Methodology 196
Preventive Controls for CAATTs 197
Detective Controls for CAATTs 198
Corrective Controls for CAATTs 199
Quality Assurance Reviews and Reports 200
Summary and Conclusions 200
CHAPTER 7 Challenges for Audit 203
Survival of Audit 203
Audit as a Learning Organization 204
Knowledge Acquisition 204
Information Dissemination 205
Information Interpretation 205
Organizational Memory 205
New Paradigm for Audit 206
Computer-Assisted Audit Techniques 206
Computer-Aided Audit Thought Support 207
Auditor Empowerment 208
Access to Microcomputers and Computer Networks 209
Access to Audit Software-Meta-Languages 209
Universal Access to Data 210
Access to Education, Training, and Research 210
Skills Inventory 212
Needed versus Actual Skills 212
Required versus Actual Performance 215
Auditor Skills for Using CAATTs 216
IS Auditor Skills 216
Training Programs and Requirements 217
Conceptual Training 217
Technical Training 218
Training Options 218
In-house 218
Professional Associations 218
Educational Institutions 219
Computer-Based, Video-Based, and Web-Based Training 219
Summary and Conclusions 220
Appendices 223
APPENDIX A The Internet-An Audit Tool 225
The Internet 225
Connecting to the Internet 225
General Internet Uses 226
Useful Sites for Auditors 229
Examples of Audit-Related Internet Usage 230
APPENDIX B Information Support Analysis and Monitoring (ISAM) Section 231
APPENDIX C Information Management Concepts 235
APPENDIX D Audit Software Evaluation Criteria 241
General Capabilities 241
Reporting Capabilities 241
Graphics Capabilities 242
Mathematical Functions 242
File Manipulation Capabilities 242
Record Definition Capabilities 242
File Type Capabilities 242
Programming Capabilities 242
Support 243
Other Capabilities 243
References 245
Index 249
